Missing Authorization Vulnerability in Eyewear Prescription Form Plugin for WordPress

CVE-2025-14366

What is CVE-2025-14366?

The Eyewear Prescription Form Plugin for WordPress is susceptible to a Missing Authorization vulnerability, impacting all versions up to and including 6.0.1. This vulnerability arises from inadequate authorization checks on the SubmitCatProductRequest AJAX action, enabling unauthenticated malicious users to create new WooCommerce products with arbitrary attributes, such as custom names, prices, and category mappings by manipulating the 'Name', 'Price', and 'Parent' parameters.

References